Privacy

Who we are

Elaris TCG is an online anime trading card game, published by a micro-enterprise (see the legal notice). This page explains what data is collected, why, and how you can control it.

Data collected

• Account — username, email address, password. The password is never stored in plain text: it is hashed, a one-way transformation. Even we cannot recover your password from what is stored — only verify that a password you enter matches it.
• Game — crystals, cards owned, trades, shop purchases, progression and ranking statistics.
• Payment — when you make a purchase, the payment is processed by Stripe, which receives the information needed for the transaction (email, amount, card details entered directly with Stripe). Elaris TCG neither sees nor keeps any banking data; we only keep a transaction ID and the purchase details for accounting.
• Social — messages exchanged with your friends in-game, friend requests.
• Security — IP addresses of login attempts, kept for rate limiting (brute-force protection) and abuse detection.
• Technical — session cookie, strictly necessary for the site to work (staying logged in). This cookie requires no consent.

Cookies and third-party services

The site uses three categories of cookies and similar technologies:

• Strictly necessary — session cookie, essential to stay logged in. Set without consent.
• Analytics — Google Analytics, to understand site usage in an aggregated way. Set only with your consent.
• Advertising — Google AdSense displays ads and may set cookies to measure and, where applicable, personalise ads. The ad-free subscription removes these ads. Set only with your consent.

You can accept or refuse non-essential cookies via the consent banner, and change your choice at any time. Refusing does not prevent you from playing.

Data recipients

Your data may be shared with our processors strictly within the scope of the service: Stripe (payment), Google (analytics and advertising, subject to your consent) and Hostinger (hosting). No data is sold.

Password check

At sign-up and when changing your password, Elaris TCG checks that the chosen password does not already appear in a known public data breach, using a specialised service (Have I Been Pwned). Your password is never sent to this service, neither in plain text nor in a form that would allow it to be recovered.

Retention period

Account data is kept as long as the account exists. An account deletion request triggers a grace period of 30 days: the account becomes immediately inaccessible, but nothing is erased yet, to give you time to cancel in case of a mistake (by logging back in). After this period, personal data (username, email, password, bio, avatar) is permanently anonymised; economic data already linked to other players (completed trades, closed market sales) is kept in anonymised form to preserve the game's consistency. Billing data linked to purchases is kept for as long as required by accounting and tax obligations. Login attempt logs (IP addresses) are kept for a limited time, strictly necessary for the security of the service.

Your rights

In accordance with the GDPR, you have a right of access, rectification, erasure, portability and objection over your personal data:

• Access and portability — download a copy of your data from Settings → Export my data.
• Rectification — edit your profile directly from Settings.
• Erasure — delete your account at any time from Settings.

For any other question, request regarding your data, or to refer a dispute to the CNIL, contact: support@elaris.fun